From 958c1c29c201b6a23fd5e7eaedb1499f0d6f404a Mon Sep 17 00:00:00 2001 From: Brady Miller Date: Thu, 22 Mar 2018 08:05:32 -0700 Subject: [PATCH] security fixes (#1519) --- interface/billing/get_claim_file.php | 16 +++-- interface/billing/sl_eob_process.php | 56 +++++++++-------- interface/billing/sl_eob_search.php | 51 +++++++--------- .../de_identification_forms/find_code_popup.php | 70 ++++++++++------------ .../find_immunization_popup.php | 64 ++++++++++---------- interface/fax/fax_dispatch.php | 9 ++- interface/forms/CAMOS/view.php | 36 +++++------ interface/forms/reviewofs/view.php | 4 +- interface/main/finder/finder_navigation.php | 15 ++++- interface/orders/types.php | 18 +++--- interface/patient_file/letter.php | 58 +++++++++++++----- .../patient_file/transaction/add_transaction.php | 4 +- library/custom_template/personalize.php | 39 ++++-------- library/sanitize.inc.php | 16 ++--- 14 files changed, 243 insertions(+), 213 deletions(-) diff --git a/interface/billing/get_claim_file.php b/interface/billing/get_claim_file.php index 4af5c0f3a..2b1a4b27f 100644 --- a/interface/billing/get_claim_file.php +++ b/interface/billing/get_claim_file.php @@ -1,8 +1,14 @@ + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + */ + require_once(dirname(__FILE__) . "/../globals.php"); require_once $GLOBALS['OE_SITE_DIR'] . "/config.php"; @@ -22,7 +28,7 @@ if (strtolower(substr($fname, (strlen($fname)-4))) == ".pdf") { $fname = $claim_file_dir . $fname; if (!file_exists($fname)) { - echo xl("The claim file: ") . $_GET['key'] . xl(" could not be accessed."); + echo xl("The claim file: ") . text($_GET['key']) . xl(" could not be accessed."); } else { $fp = fopen($fname, 'r'); diff --git a/interface/billing/sl_eob_process.php b/interface/billing/sl_eob_process.php index cc134f875..c66669d23 100644 --- a/interface/billing/sl_eob_process.php +++ b/interface/billing/sl_eob_process.php @@ -1,15 +1,19 @@ - // - // This program is free software; you can redistribute it and/or - // modify it under the terms of the GNU General Public License - // as published by the Free Software Foundation; either version 2 - // of the License, or (at your option) any later version. - - // This processes X12 835 remittances and produces a report. - - // Buffer all output so we can archive it to a file. - ob_start(); +/** + * This processes X12 835 remittances and produces a report. + * + * @package OpenEMR + * @link http://www.open-emr.org + * @author Rod Roark + * @author Brady Miller + * @copyright Copyright (c) 2006-2010 Rod Roark + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + */ + + +// Buffer all output so we can archive it to a file. +ob_start(); require_once("../globals.php"); require_once("$srcdir/invoice_summary.inc.php"); @@ -20,15 +24,15 @@ require_once("adjustment_reason_codes.php"); require_once("remark_codes.php"); require_once("$srcdir/billing.inc"); - $debug = $_GET['debug'] ? 1 : 0; // set to 1 for debugging mode - $paydate = parse_date($_GET['paydate']); - $encount = 0; +$debug = $_GET['debug'] ? 1 : 0; // set to 1 for debugging mode +$paydate = parse_date($_GET['paydate']); +$encount = 0; - $last_ptname = ''; - $last_invnumber = ''; - $last_code = ''; - $invoice_total = 0.00; - $InsertionId;//last inserted ID of +$last_ptname = ''; +$last_invnumber = ''; +$last_code = ''; +$invoice_total = 0.00; +$InsertionId;//last inserted ID of ///////////////////////// Assorted Functions ///////////////////////// @@ -640,7 +644,7 @@ if (!$debug) { $fnreport = "$nameprefix$namesuffix.html"; $fhreport = fopen($fnreport, 'w'); if (!$fhreport) { - die(xl("Cannot create") . " '$fnreport'"); + die(xl("Cannot create") . " '" . text($fnreport) . "'"); } } @@ -738,12 +742,12 @@ if ($alertmsg) { } ?> - - - - - - + + + + + + diff --git a/interface/billing/sl_eob_search.php b/interface/billing/sl_eob_search.php index e485ff17e..46d3e3f4d 100644 --- a/interface/billing/sl_eob_search.php +++ b/interface/billing/sl_eob_search.php @@ -2,28 +2,21 @@ /** * This the first of two pages to support posting of EOBs. * The second is sl_eob_invoice.php. - * Windows compatibility and statement downloading: - * 2009 Bill Cernansky and Tony McCormick [mi-squared.com] * - * Copyright (C) 2005-2010 Rod Roark - * - * LICENSE: This program is free software; you can redistribute it and/or - * modify it under the terms of the GNU General Public License - * as published by the Free Software Foundation; either version 2 - * of the License, or (at your option) any later version. - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - * You should have received a copy of the GNU General Public License - * along with this program. If not, see ;. - * - * @package OpenEMR - * @author Rod Roark - * @author Roberto Vasquez - * @author Jerry Padgett - * @link http://www.open-emr.org + * @package OpenEMR + * @link http://www.open-emr.org + * @author Rod Roark + * @author Bill Cernansky + * @author Tony McCormick + * @author Roberto Vasquez + * @author Jerry Padgett + * @author Brady Miller + * @copyright Copyright (c) 2005-2010 Rod Roark + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 */ + + require_once("../globals.php"); require_once("$srcdir/patient.inc"); require_once("$srcdir/invoice_summary.inc.php"); @@ -642,14 +635,14 @@ if (($_POST['form_print'] || $_POST['form_download'] || $_POST['form_email'] || - ' + ' title=''> - ' + ' onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' title=''> @@ -658,7 +651,7 @@ if (($_POST['form_print'] || $_POST['form_download'] || $_POST['form_email'] || - ' + ' onkeyup='datekeyup(this,mypcc)' onblur='dateblur(this,mypcc)' title=''> @@ -667,7 +660,7 @@ if (($_POST['form_print'] || $_POST['form_download'] || $_POST['form_email'] || - ' + ' title=''> @@ -684,35 +677,35 @@ if (($_POST['form_print'] || $_POST['form_download'] || $_POST['form_email'] || - ' + ' title=''> - ' + ' title=''> - ' + ' title=''> - ' + ' title=''> - ' + ' title=''> diff --git a/interface/de_identification_forms/find_code_popup.php b/interface/de_identification_forms/find_code_popup.php index 3088b8e11..16c400867 100644 --- a/interface/de_identification_forms/find_code_popup.php +++ b/interface/de_identification_forms/find_code_popup.php @@ -1,21 +1,17 @@ + * @author Brady Miller + * @copyright Copyright (c) ViCarePlus, Visolve + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + */ + + require_once("../globals.php"); require_once("$srcdir/patient.inc"); require_once("../../custom/code_types.inc.php"); @@ -37,14 +33,14 @@ td { font-size:10pt; } @@ -130,7 +126,7 @@ function check_search_str() \n"; + echo "\n"; } else { echo " ' + ' title='' /> -   - ' /> +   + ' /> @@ -187,7 +183,7 @@ if ($codetype) { $drug_id = addslashes($row['drug_id']); $selector = addslashes($row['selector']); $desc = addslashes($row['name']); - ?> + ?> "; } } else { @@ -205,7 +201,7 @@ if ($codetype) { echo xl('Please enter new search string');?>"); document.theform.search_term.value=" "; document.theform.search_term.focus(); - +
' onclick="chkbox_select_all(document.select_diagonsis.chkbox);"/> - + ' onclick="chkbox_select_none(document.select_diagonsis.chkbox);"/> - + ' onclick="window_submit(document.select_diagonsis.chkbox);"/> - + ' onclick="window_close();"/> - - + + diff --git a/interface/de_identification_forms/find_immunization_popup.php b/interface/de_identification_forms/find_immunization_popup.php index 4ac1887e4..f03e17614 100644 --- a/interface/de_identification_forms/find_immunization_popup.php +++ b/interface/de_identification_forms/find_immunization_popup.php @@ -1,21 +1,17 @@ + * @author Brady Miller + * @copyright Copyright (c) ViCarePlus, Visolve + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + */ + + require_once("../globals.php"); require_once("$srcdir/patient.inc"); require_once("../../custom/code_types.inc.php"); @@ -35,14 +31,14 @@ td { font-size:10pt; } @@ -125,10 +121,10 @@ function check_search_str() - ' + ' title='' />   - ' /> + ' /> @@ -143,7 +139,7 @@ function check_search_str() -
+ "); document.theform.search_term.value=" "; document.theform.search_term.focus(); - +
' onclick="chkbox_select_all(document.select_immunization.chkbox);"/> - + ' onclick="chkbox_select_none(document.select_immunization.chkbox);"/> - + ' onclick="window_submit(document.select_immunization.chkbox);"/> - + ' onclick="window_close();"/> - +
diff --git a/interface/fax/fax_dispatch.php b/interface/fax/fax_dispatch.php index 4d2c81727..a8c98d0a7 100644 --- a/interface/fax/fax_dispatch.php +++ b/interface/fax/fax_dispatch.php @@ -7,10 +7,11 @@ * @author Rod Roark * @author Brady Miller * @copyright Copyright (c) 2006-2010 Rod Roark - * @copyright Copyright (c) 2017 Brady Miller + * @copyright Copyright (c) 2017-2018 Brady Miller * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 */ + require_once("../globals.php"); require_once("$srcdir/patient.inc"); require_once("$srcdir/pnotes.inc"); @@ -22,13 +23,17 @@ if ($_GET['file']) { $mode = 'fax'; $filename = $_GET['file']; - // ensure the file variable has no illegal characters + // ensure the file variable has no illegal characters check_file_dir_name($filename); $filepath = $GLOBALS['hylafax_basedir'] . '/recvq/' . $filename; } else if ($_GET['scan']) { $mode = 'scan'; $filename = $_GET['scan']; + + // ensure the file variable has no illegal characters + check_file_dir_name($filename); + $filepath = $GLOBALS['scanner_output_directory'] . '/' . $filename; } else { die("No filename was given."); diff --git a/interface/forms/CAMOS/view.php b/interface/forms/CAMOS/view.php index 50c735df0..d7e55e2e7 100755 --- a/interface/forms/CAMOS/view.php +++ b/interface/forms/CAMOS/view.php @@ -1,30 +1,32 @@ - * @author fndtn357 - * @author cornfeed - * @author cfapress - * @author Wakie87 - * @author Robert Down - * @author Brady Miller + * @package OpenEMR + * @link http://www.open-emr.org + * @author markleeds + * @author fndtn357 + * @author cornfeed + * @author cfapress + * @author Wakie87 + * @author Robert Down + * @author Brady Miller + * @copyright Copyright (c) 2008 cfapress * @copyright Copyright (c) 2009 markleeds - * @copyright Copyright (c) 2012 fndtn357 * @copyright Copyright (c) 2011 cornfeed - * @copyright Copyright (c) 2008 cfapress + * @copyright Copyright (c) 2012 fndtn357 * @copyright Copyright (c) 2016 Wakie87 + * @copyright Copyright (c) 2016-2018 Brady Miller * @copyright Copyright (c) 2017 Robert Down - * @copyright Copyright (c) 2016 Brady Miller - * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 */ + + ?> " type="text/css"> -
" name="my_form"> +" name="my_form">

diff --git a/interface/forms/reviewofs/view.php b/interface/forms/reviewofs/view.php index 9ca68de17..3e1d05e00 100644 --- a/interface/forms/reviewofs/view.php +++ b/interface/forms/reviewofs/view.php @@ -8,7 +8,7 @@ * @author Brady Miller * @author Robert Down * @copyright Copyright (c) 2008 cfapress - * @copyright Copyright (c) 2016-2017 Brady Miller + * @copyright Copyright (c) 2016-2018 Brady Miller * @copyright Copyright (c) 2017 Robert Down * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 */ @@ -40,7 +40,7 @@ $obj = formFetch("form_reviewofs", $_GET["id"]);
- " name="my_form" onsubmit="return top.restoreSession()"> + " name="my_form" onsubmit="return top.restoreSession()">
diff --git a/interface/main/finder/finder_navigation.php b/interface/main/finder/finder_navigation.php index 18fe37042..a1c4c1ed1 100644 --- a/interface/main/finder/finder_navigation.php +++ b/interface/main/finder/finder_navigation.php @@ -1,5 +1,16 @@ + * @copyright Copyright (c) 2018 Brady Miller + * @license https://github.com/openemr/openemr/blob/master/LICENSE GNU General Public License 3 + */ + + +require_once("../../globals.php"); ?> @@ -19,7 +30,7 @@ include_once("../../globals.php");
- +